Not yet human-reviewed
This source record was written automatically by the research pipeline and has not yet been reviewed by the maintainer or integrated into a topic page. Treat it as a provisional summary and verify claims against the original source.
A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
Citation. Brömme, A. (2026). A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits. arXiv preprint arXiv:2609.04017.
Summary. This position and architecture paper proposes an external, blockchain-anchored evidence layer for selected events in agentic workflows, including agent communications, tool calls, process artifacts, and human approvals. It frames the design as support for later audit, incident reconstruction, and GRC evidence work while retaining sensitive content off-chain. The paper explicitly distinguishes integrity and temporal anchoring from stronger claims about authenticity, authorization, causal traceability, semantic truth, or prevention of agent misbehavior.
Key claims
- Blockchain-anchored cryptographic commitments can provide evidence that selected agentic artifacts existed in a particular form by a given time and were not subsequently altered without detection.
- Event ordering, capture authenticity, authorized anchoring, and causal traceability require architectural controls beyond a cryptographic timestamp or artifact hash.
- A selective evidence layer can cover agent-to-agent messages, human approval requests, tool-call parameters and results, intermediate files, tickets, policy decisions, and system-state snapshots without placing their sensitive content on-chain.
- The proposed architecture is a product- and vendor-neutral position rather than an evaluated containment mechanism, security control, or proof of the semantic truth of recorded events.
Evidence & limitations
- Five-page arXiv preprint by an independent researcher; it is a position and architecture paper rather than an empirical deployment, performance, or security evaluation.
- The source’s GRC and regulatory-readiness discussion is conceptual, so its claims should be treated as design propositions rather than evidence of effectiveness or compliance.